← Back to home— security & trust
Built for HR data — handled like it.
We process some of the most sensitive personal data on the planet: candidate CVs. Here's exactly how we keep them safe, and what we're audited against.
How we treat your data
🔒
Encryption everywhere
TLS 1.3 in transit. AES-256 at rest. Customer data is encrypted with workspace-scoped keys; you can also bring your own KMS on Scale and above.
⌖
60-second file retention
Uploaded CVs are wiped from disk within 60 seconds of a successful parse. We retain only the structured JSON output for 30 days (12 months on Scale) for retrieval via the API.
⬚
EU & UK data residency
Default region is eu-west-2 (London). Pin processing to eu-west, uk-south, or us-east-1 on Scale. We never move customer data across regions for our own purposes.
◐
No training on your data
Customer CVs and parses are never used to train, fine-tune, or evaluate our models. Period — including by our LLM sub-processors.
▣
RBAC + audit logs
Workspaces support owner / admin / developer / viewer roles. Every API key issuance, rotation, and revocation is logged with actor, IP, and timestamp.
↻
Quarterly key rotation
We rotate workspace signing secrets and internal credentials quarterly. Old secrets stay valid for 30 days to give you a graceful migration window.
Compliance
UK DPA 2018
Compliant2018+
SOC 2 Type II
In progressAudit Q3 2026
We sign DPAs on request — including Standard Contractual Clauses for non-EEA transfers and BSI-aligned schedules. Email security@cvparser.io.
Infrastructure
Hosting
AWS — eu-west-2 (London) primary, eu-west-1 (Dublin) DR.
Compute
Kubernetes on EKS, hardened workers, pod-level isolation.
Storage
S3 with bucket-level encryption + KMS. Daily integrity scrubs.
Networking
WAF + DDoS shield. VPC-isolated. No public DB endpoints.
Secrets
AWS Secrets Manager, IAM roles for service auth, no long-lived creds.
Monitoring
Datadog SIEM + alerting. On-call 24/7. 8-min mean response to P1.
Incident response & disclosure
We commit to a 24-hour breach notification window. If you've found a vulnerability, please email security@cvparser.io directly, or use our PGP key 7C4A 8B19 .... We run a private bug bounty on HackerOne; reach out for an invite.
Need our SIG or full security questionnaire?
We have current SIG Lite and CAIQ-Lite responses ready to share under NDA.